[vksp2k7]

Target

• Base repository: artcraft-android/pdfcraft-android
• Base branch: main
• Head repository: vksp2k7/pdfcraft-android
• Head branch: feat/digital-signature-upstream-port
• Head commit: f94bc3eaed0134b86782a68427eed972c9705a96

Summary

This ports the upstream (storytold/pdfcraft) digital-signature implementation into the Android fork and completes the Android-side validation/trust flow. In particular, trusting a signer now invalidates the engine and Android rendering caches, so the signature appearance changes immediately from unverified to validated without reopening the document.

Validated signatures use the same visual style as Adobe Acrobat (green check / tick mark overlaid in the signature widget). This matches the appearance users expect from Acrobat (see issue 79). A simple background tick circle is intentionally avoided because some users require the same style as Acrobat’s tick sign.

Scope relative to upstream PR 2808:
This Android PR is not a port of that desktop PR and does not claim to supersede or fully re-implement everything it does. Upstream PR 2808 focuses on desktop named-layer status redraw (n1/n3/n4), Lucide icons, multi-language captions, ActualText extraction changes, redaction interactions with outline captions, and a hardened signature-field walk. This branch instead:

• Ports the broader upstream signing/validation engine work (PKCS#12 hardening, certificate-chain validation, appearance rebuild on trust, stricter signing-certificate usage checks, cos revision/xref support required by validation).
• Adds the Android-specific trust-refresh path so Compose and page-image caches pick up the new validated appearance immediately.
• Uses Acrobat-style validated appearance graphics rather than a minimal background circle.

It therefore solves the same core user-visible problem that PR 2808 targets on desktop (validated appearance updates live after trust, matching Acrobat) for the Android product, plus the full signing/validation port that Android was missing. It does not include the desktop-only layers of PR 2808 (named-layer detection heuristics, Lucide embedding into page content, ActualText/redaction changes, field-walk memory caps, etc.).

What changed

• Ported the upstream signing implementation, including hardened PKCS#12 handling, certificate-chain validation, validated signature appearances (Adobe Acrobat–style green tick rather than a simple background circle), stricter signing-certificate usage checks, and the related tests.
• Added the missing native pdfcraft-cos::Document functionality required by signature validation:
  • Reopen a revision using the document's original encryption credentials.
  • Track cross-reference entries that the reader had to set aside.
  • Distinguish exact cross-reference entries from entries recovered by object scanning.
• Removed the temporary signing compatibility shim now that the cos APIs are implemented natively.
• Incremented the engine document generation after trusted-signature appearances are rebuilt.
• Refreshes Android document/signature state after trust changes so Compose and page-image caches request the new rendering.
• Empty PDF signature fields now offer both actions:
  • Add your signature using the existing handwritten Fill & Sign flow.
  • Sign with a digital ID using a certificate-based signature.
• Preserved the existing signature details UI, including signer information, certificate details, modification classification, validation explanations, trust/untrust controls, and navigation to the signature location.
• Updated digital-ID password validation to match the engine's eight-character minimum.

User-visible behavior

• Valid signatures display as validated using the Acrobat–style green tick (not a simple circle), satisfying users who require visual parity with Acrobat.
• Unknown but intact signatures remain visibly unverified until the signer is trusted.
• Invalid signatures are shown as invalid.
• Trusting or untrusting a signer updates the signature state and rendered appearance immediately; reopening the PDF is not required.
• Tapping an empty signature field no longer silently enters only the handwritten scribble flow; it presents the two signing choices listed above.

Verification

Passed:

• cargo fmt --all -- --check
• git diff --check
• cargo test -p pdfcraft-cos
• cargo test -p pdfcraft-sign
• cargo test -p pdfcraft-automation
• ./gradlew testDebugUnitTest --no-daemon
• Android assembleRelease using a temporary sample PKCS#12 release key

The following targeted signature regressions now pass normally rather than being ignored:

• Encrypted earlier revisions reopen with the document's own credentials.
• Cross-reference entries set aside by the reader are tracked.
• Cross-reference entries that require object scanning are not treated as exact unchanged objects.

Known unrelated workspace issues

• One existing OCR engine test fails reproducibly because the OCR output is "auick brown fox jumps over the lazy dog" instead of the expected "quick brown fox jumps over the lazy dog". The failure is unrelated to the signature changes; the other 217 engine tests passed in the full run.
• Workspace clippy currently stops at the existing clippy::items-after-test-module lint in crates/cos/src/lib.rs. This is unrelated to the signature changes and is not introduced by this branch.

Review notes

The Android trust-refresh change is intentionally small: it refreshes the open document after sign_trust updates the engine. The signature-validation and cache-correctness behavior is covered by the cos and signing regression tests listed above.

The appearance work here deliberately follows Acrobat’s green-tick style for the same user requirement that motivated the upstream desktop work; it is the Android-side solution to the live validated-appearance problem, not a re-implementation of every detail of the desktop PR.